CVE-2015-3004

J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 befor...

CVE-2015-3004

CVE-2015-3004 affects Juniper Junos J-Web across listed 11.4, 12.x, 13.x, 14.x versions. Root cause: J-Web fails to emit an X-Frame-Options header, enabling remote clickjacking. Impact is generally exposure to UI spoofing/administrative actions via a framed page. Affected products/versions includ...

CVE-2015-3004: Improper Input Validation

J-Web in Juniper Junos 11.4 before 11.4R12, 12.1X44 before 12.1X44-D35, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D10, 12.3X48 before 12.3X48-D10, 12.2 before 12.2R9, 12.3 before 12.3R7, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R5, 14.1 before 14.1R3, 14.1X53 befor...

PT-2015-6048

Name of the Vulnerable Software and Affected Versions Junos versions 11.4 through 11.4R11, 12.1X44 through 12.1X44-D34, 12.1X46 through 12.1X46-D24, 12.1X47 through 12.1X47-D9, 12.3X48 through 12.3X48-D9, 12.2 through 12.2R8, 12.3 through 12.3R6, 13.2 through 13.2R5, 13.2X51 through 13.2X51-D19,...

Apple iOS Webkit Clickjacking Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. An unspecified clickjacking vulnerability exists in Apple iOS Webkit, which allows attackers to exploit the vulnerability to construct malicious URIs, trick users into parsing them, and redirect user...

GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201504-01 Mozilla Products: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker...

Mozilla Products: Multiple vulnerabilities

Background Mozilla Firefox is an open-source web browser and Mozilla Thunderbird an open-source email client, both from the Mozilla Project. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the ‘Mozilla...

Coinbase: Sandboxed iframes don't show confirmation screen

Just like I anticipated in 2013 http://homakov.blogspot.com/2013/04/html5-sandbox-bad-idea.html sandbox was a bad idea. As a payment gateway you do your best to seamlessly integrate with your customers and allow showing checkout in iframes. To prevent basic clickjacking you have data-confirm...

Mozilla Firefox Hijacking Attack Vulnerability

Mozilla Firefox is a web browser developed by the Mozilla Foundation in conjunction with the open source community. A hijacking attack vulnerability exists in versions of Mozilla Firefox prior to 37.0, which can be exploited by remote attackers to construct malicious HTML pages, trick users into...

CVE-2015-0810

Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element...

CVE-2015-0810

Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element...

Design/Logic Flaw

Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element...

CVE-2015-0810

CVE-2015-0810 affects Mozilla Firefox on macOS prior to version 37.0. The vulnerability arises when Firefox does not ensure the cursor is visible, enabling remote attackers to perform clickjacking via a Flash object in combination with layered DIV elements and crafted JavaScript that interacts wi...

CVE-2015-0810

Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element...

Firefox < 37.0 Multiple Vulnerabilities (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 37.0. It is, therefore, affected by the following vulnerabilities : - A privilege escalation vulnerability exists which relates to anchor navigation. A remote attacker can exploit this to bypass same-origin policy protection...

CVE-2015-0810: Improper Input Validation

Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element...

FreeBSD : mozilla -- multiple vulnerabilities (d0c97697-df2c-4b8b-bff2-cec24dc35af8)

The Mozilla Project reports : MFSA-2015-30 Miscellaneous memory safety hazards rv:37.0 / rv:31.6 MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack MFSA-2015-33 resource:// documents can...

PT-2015-4885

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 37.0 on OS X Description The issue allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: MFSA-2015-30 Miscellaneous memory safety hazards rv:37.0 / rv:31.6 MFSA-2015-31 Use-after-free when using the Fluendo MP3 GStreamer plugin MFSA-2015-32 Add-on lightweight theme installation approval bypassed through MITM attack MFSA-2015-33 resource:// documents can...

Cursor clickjacking with flash and images — Mozilla

Security researcher Jordi Chancel reported a mechanism that made cursor invisible through flash content and then replaced it through the layering of HTML content. This flaw can be in used in combination with an image of the cursor manipulated through JavaScript, leading to clickjacking during...